Elastic Security & the Stack

TheoryBeginner11 minLog AnalysisSIEM Operation

Indices, Documents and Fields

What is it?

The Elastic Stack is Elasticsearch (the store/search engine) and Kibana (the UI). It stores each log event as a JSON document with named fields (user.name, source.ip, event.action). Documents live in indices, and a data view groups the indices you search in Kibana.

Why it matters

You search fields, not raw text. Knowing that events are documents with structured fields — and that Elastic Common Schema (ECS) gives them consistent names — is what lets you write a precise query instead of guessing at words.

Where you see it

In Discover: pick a data view (e.g. logs-*), and each row expands to its fields — user.name: j.rai, source.ip: 10.20.4.33, event.outcome: failure. The field list on the left shows what you can query.

What normal looks like

A healthy data view shows recent documents with populated ECS fields. You recognize the fields your question needs (who, from where, what outcome) before writing a single query.

What suspicious looks like

Not the data — but if a field you expect is empty or missing, the parsing or the data view is wrong, not the world. Confirm the field exists and is populated before concluding 'no evidence'.

How analysts investigate

Open Discover on the right data view, scan the field list to learn the schema, expand a document to see real field names and values, and only then translate your question into a field query.

Common beginner mistakes

Free-text searching for a word when the value lives in a named field you could match exactly.
Blaming the data for 'no results' when the real cause is the wrong data view or time range.

Events are documents; you search their fields

  index: logs-auth-2026.08        (a data view can span logs-*)
   ┌─ document (one event, JSON) ──────────────────────────┐
   │  @timestamp   2026-08-25T02:14:02Z                     │
   │  user.name    j.rai        event.action  login        │
   │  source.ip    185.220.101.9   event.outcome  success   │
   └────────────────────────────────────────────────────────┘
  KQL queries the FIELDS:  user.name:"j.rai" and event.outcome:success

Each event is a JSON document of ECS fields inside an index; KQL matches those fields, not raw text.

Quick check

In Elastic, what do you actually write a KQL query against?

A quick self-check — it doesn't affect your XP or progress.